Experimental investigation of quantum key distribution with position and momentum 
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We investigate the utility of Einstein-Podolsky-Rosen correlations of the position and momentum 
of photon pairs from parametric down-conversion in the implementation of a secure quantum key 
distribution protocol. We show that security is guaranteed by the entanglement between down- 
converted pairs, and can be checked by either direct comparison of Alice and Bob's measurement 
results or evaluation of an inequality of the sort proposed by Mancini et al. (Phys. Rev. Lett. 88, 
120401 (2002)). 



42.50.Ar, 42. 25. Kb 



I. INTRODUCTION 



Quantum communication protocols using photonic 
qubits have been proposed and implemented, utilizing 
entanglement in several degrees of freedom of the photon 
[1]. Perhaps the most promising application of quantum 
communication using photons is quantum key distribu- 
tion (QKD) [1,2], in which entangled or single qubits are 
sent from sender to receiver (s) and used to establish a 
secret random key string, which can then be used to se- 
curely transmit a data string. Most QKD schemes are in- 
spired by the original single-qubit BB84 [3] or entangled- 
qubit Ekert [4] protocols. In the BB84 protocol, crypto- 
graphic security is provided by the partial indistinguisha- 
bility of non-orthogonal states and the no-cloning theo- 
rem, while the security of the Ekert protocol is guaran- 
teed by violation of Bell's inequality. For photon pairs, 
obtained from spontaneous parametric down-conversion 
(SPDC), entanglement in polarization [5] and energy- 
time [6] have been most widely and sucessfully used. 

There have also been QKD proposals based on con- 
tinuous variable field quadratures of multiphoton beams 
[7] . Again, security of these protocols is based on either 
measurement of non-commuting observables and the no- 
cloning theorem or violation of some classical inequality. 

In this paper, we present a protocol for QKD based 
on the position and momentum degrees of freedom en- 
tangled photons created by SPDC. Recently, it has been 
shown that the difference between the positions of entan- 
gled SPDC photons along with the sum of their momenta 
are Einstein-Podolsky-Rosen (EPR) correlated, or, in 
other words, entangled [8]. These correlations are in- 
teresting not only for their direct relation to the seminal 
paper by EPR [9], but also for their possible application 
to quantum information tasks. To our knowledge, the 
work we present here is the first quantum information 
protocol based on position and momentum entanglement 
of the form originally proposed by EPR. Entanglement 
in position and momentum is easily obtained, since it is 
a direct consequence of the inherent phase matching con- 
ditions in the parametric process. Moreover, it has been 
demonstrated that it is possible to protect this type of 



entanglement against divergence due to free-space trans- 
mission of the down-converted photons [10]. Therefore 
quantum key distribution in position-momentum vari- 
ables could be a promising application. 

In section II we present the QKD protocol, and discuss 
basic security issues in section III. Section IV shows ex- 
perimental results confirming the utility of position and 
momentum EPR correlations in QKD. 
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FIG. 1. Diagram of quantum key distribution using po- 
sition and momentum variables of down-converted photons. 
The SPDC source emits photons entangled in position and 
momentum. Lenses are used to create the image (posi- 
tion measurments) or Fourier transform (momentum mea- 
surements) in Alice and Bobs detection planes. THe 50-50 
non-polarizing beam splitters (BS) are used to choose ran- 
domly between position and momentum measurements. 

Fig. 1 shows a diagram of the basic QKD apparatus. 
The protocol works as follows. Twin photons are created 
by a SPDC source. One photon of each pair is sent to 
Alice (A), and one to Bob (B). At each of Alice and 
Bob's stations, a random selection between detection in 
the position (x) or momentum (p) basis is performed by a 
50-50 non-polarizing beam splitter (BS). A measurement 
in the x basis is easily performed by a lens imaging the 
crystal onto the detection plane. It is well known that 
a measurement in the p basis can be implemented by a 
lens with crystal and detection planes in its focal planes 
[11], as was done in Refs. [8]. 

Before any photons transmitting potential key bits are 
exchanged, Alice and Bob calibrate their x detectors for 
positions Ax\ and Ax 2 and Bxi and Bx2, and their p 
detectors at positions Api and Ap 2 and Bpi and Bp 2 , 
respectively. Let us assume that, in both bases, detector 
position "1" ("2") represents the (1) logical level. From 
the multimode theory of SPDC [10,12], it is possible to 
show that, for ideal point-like detectors, the probability 
to detect photon pairs is 

P XX (PA, P B)K\W(ap A +f3p B )8 (ap A - (3p B )\ 2 (1) 

for a position-position (xx) configuration. The notation 
"ij" refers to the situation where Alice measures in the i 
basis and Bob in the j basis, where i,j = x,p. Here W is 
the held profile of the pump beam at the crystal face. We 
define the parameters a = Oa/ (2/a) an d = Os/(27 B ), 
which are related to the magnification factors of Alice's 
and Bob's imaging systems. We have also assumed that 
both imaging lenses have been placed so as to obey the 
thin lens equation. The delta function appears due to the 
fact that we have considered ideal point-like detectors. 
Since the pump beam profile W can be made much larger 
than the delta function, it is possible to find positions p A 
and ps such that W is approximately constant. 

Similarly, for a momentum-momentum (pp) configura- 
tion, 



Pp P (PA, Pb) oc 
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where v is the angular spectrum of the pump beam at 
the crystal face. If they measure in the same basis, Alice 
and Bob can calibrate their detectors so that they see a 
large correlation in their coincidence measurements. For 
example, if Alice detects a photon at Ax\, then the prob- 
ability for Bob to detect a photon at Bxi will be much 
greater than the probability to detect a photon at Bx 2 . 
In general, Alice and Bob can choose positions such that 



P(Ax 1 ,Bx 1 ) w P(Ax 2 ,Bx 2 ) » 
P(Ax 1 ,Bx 2 ) « P(Ax 2 ,Bx 1 ) w 0, 



(3) 
(4) 



where P(A, B) is the coincidence detection probability. 
The same is true for measurements in the p basis: 



P(A Pl ,B Pl ) 
P(A Pl ,Bp 2 ) 



P{A P2 ,Bp 2 ) »0 
iP(Ap 2 ,B Pl ) wfl. 



(5) 
(6) 



Moreover, Alice and Bob can adjust their detection 
systems such that P(Ax\, Bx\) w P(Ax 2 , Bx 2 ) « 
P(Api, Bpi) « P(Ap 2 ,Bp 2 ). In the interest of simplic- 
ity, we will remove the subscripts on the probabilities Pij 
whenever redundant. 

The security of the QKD protocol is conditioned on the 
fact that the correlation is low when the measurements 
are performed in different bases, so that very little infor- 
mation is shared. For example, if Alice detects a photon 
at Axi, then the probability for Bob to detect a photon 
at Bpi should be the same as the probability to detect a 
photon at Bp 2 . Using the standard theory of SPDC, the 
coincidence detection probability for an xp configuration 



is 



Px P {pa,Pb) oc \W(ap A )\ 2 , 
while a px configuration gives 

P px (Pa,Pb) cx \W(f3p B )\ 2 . 



(7) 



(8) 



There is no correlation in the detection probabilities (7) 
and (8). Thus, Alice and Bob can choose their detec- 
tor positions such that P(Ax\, Bp\) = P(Ax\ 1 Bp 2 ) = 
P(Ax 2 ,B Pl ) = P(Ax 2 ,B P2 ) = P(A Pl ,B Xl ) = 
P(A Pl ,Bx 2 ) = P(Ap 2 ,B Xl ) = P(Ap 2 ,Bx 2 ). 

To generate a secret key, Alice and Bob perform a se- 
ries of measurements on a number of photon pairs until 
they have accumulated N coincidence events, where N 
depends on the size of the key and the level of secu- 
rity required. All events in which only one or neither of 
them detect a photon are discarded. After the N photon 
pairs have been detected, Bob, through classical commu- 
nication, informs Alice of his measurement basis (x or 
p) for each photon. On average, Alice and Bob mea- 
sure in the same basis 50% of the time. They keep these 
photons and discard the rest. Alice then chooses m of 
the remaining photon pairs at random and tells Bob to 
reveal his measurement result. She then uses these pho- 
ton pairs to check for an eavesdropper by comparing her 
measurement results with those of Bob. The presence 
of an eavesdropper is registered by a deterioration of the 
quantum correlation observed in the xx or pp coincidence 
events. If the error rate is below a given threshold, then 
Alice and Bob can be sure that any eavesdropper has ob- 
tained an insignificant amount of information about the 
secret key. They can then use classical privacy amplifica- 
tion and information reconciliation protocols to increase 
security and reduce errors in the key [13]. 
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III. SECURITY 

We will now discuss the security of this protocol. There 
has been much work in security proofs for a wide vari- 
ety of attacks on QKD systems [2]. We will limit our 
discussion to incoherent attacks, in which the eavesdrop- 
per (Eve) has access to one photon pair at a time. Here 
we provide a security argument for a simple attack, and 
leave more complex attacks for future work. 

If Eve steals one or both photons, then no coincidence 
is detected, the event is discarded and no information 
is obtained by Eve. One way for Eve to obtain infor- 
mation is based on an intercept-resend type strategy [2] , 
in which she steals one or both photons, measures (and 
thus destroys) them, and then replaces them with new 
photons. We note here that we call this type of gen- 
eral attack, in which Eve can measure in any basis, as 
an intercept-resend "type" strategy, in contrast to the 
usual intercept-resend strategy found in the literature in 
which Eve measures in Alice and Bob's bases. As in the 
BB84 or Ekert protocols using qubits, in this attack Eve's 
presence is marked by a deterioration of the correlation 
in Alice and Bob's measurements. 

One method of testing security is through the quantum 
bit error rate, which can be defined as a function of the 
"wrong" and "right" detection probabilities [2]: 

p wrong 

QBER = ^rr. (9) 

^ p wrong _|_ fright V ' 

In order to simplify the analysis of our experimental re- 
sults, we will not assume that P wrong + P right = 1. With 
no eavesdropper present, in our notation the QBER is 
given by 

E E ^(Aja.Bjt) 

° BE *- TTrwzm - ,10) 

j—x,p s,i— 1,2 

There are many different attack strategies that Eve 
can adopt [2]. As an example, let us consider that Eve 
implements the usual intercept-resend strategy on Bob's 
quantum channel. Let us suppose that Eve is completely 
aware of Bob's detection system and has constructed 
an identical one of her own, and denote Rij(pA, Pe) 
as the coincidence detection probability for Alice and 
Eve, where i,j — x,p. Then, Alice and Eve's detec- 
tion probability is the same as that of Alice and Bob: 
Rij(pA, Pe) = PijipA, Pb)- She intercepts and measures 
Bob's photon, giving one of the following results: Erri, 
Ex 2 , Epi, Ep 2 or a null count. She then prepares a pho- 
ton in the eigenstate corresponding her measurement re- 
sult and sends it to Bob. We will consider only the cases 
where Eve detects a photon. Then, for a given photon 
pair, Alice, Bob and Eve detect photons with probability 

Pijk{PA,PB,PE) = Rik{pA,PE)Pj{pB;k), (11) 



where i,j, k — x or p, pj(ps',k) is the probability that 
Bob will detect Eves replacement photon in basis j given 
that it was prepared in basis k, and we now limit our- 
selves to the cases where pa 1 Pb and pE are one of 
Alice, Bob or Eve's pre-defined measurement positions 
(Axi,. . . , Bxi. . . , Exi, . . . ). If Eve chooses the same 
measurement basis as both Alice and Bob, then she can 
go essentially undetected, since 

Pm(pA, Pb, Pe) = Ru(pa,Pe) — Pu(pa, Pb), (12) 

which is the detection probability that Alice and Bob ex- 
pect. Here we have assumed Eve's best-case scenario, in 
which, given that she is completely aware of his detection 
system, she can replace Bob's photon in such a way that 
Pi(pB',i) = 1- However, if Eve chooses the wrong basis, 
then, for the cases in which Alice and Bob expect a large 
detection probability Ph{pa, Pb)'- 

Pu 3 (pa,Pb,Pe) = Ri 3 (pA, PE)Pi(pB;i) < Pu(pa,Pb), 

(13) 

when i ^ j. This follows from the fact that Rij {pa, Pe) = 
P i3 {pA,PB) < Pu{pa,Pb) and Pi(p B ; j) < 1- In other 
words, the eavesdropping reduces the correlation between 
Alice and Bob's measurements. Similarly, if Eve inter- 
cepts the pair of photons by another equally entangled 
pair, she is essentially playing the role of the source and 
the protocol is not affected [14] . If she replaces the pair of 
photons by non- or less-entangled photons, then similarly 
the correlation between Alice and Bob's measurements is 
reduced and Eve's presence can be detected. 

Assuming that Eve measures every one of Bob's pho- 
tons in a basis (x or p) chosen at random, the QBER for 
Eve's intercept-resend strategy is 

E E P(Aj s ,Bj t ) + X 
QBER = ' L ; , (14) 

E E P(^js,Bj t ) 

ij—x,p s,t—l 

where 

X= E X Pj(^3f,k)P(Aj s ,Bj t ) (15) 

j.k—x,p s,t—l 

is the error due to Eve's disturbance when she mea- 
sures in the wrong basis. Here we have assumed that 
R(Aj„Ej t ) = P(Aj„Bj t ). 

From the argument above it is demonstrated that 
eavesdropping reduces the correlation between Alice and 
Bob's measurements, and that this correlation is guaran- 
teed by an EPR-like state. The EPR character can be 
demonstrated, as in Ref. [8], by satisfying the inequality 
[15]: 

A 2 (A Xl - Bxi) A 2 (A P , + B Pj ) < ^. (16) 
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To check for the presence of Eve, Alice and Bob can ei- 
ther check the correlations between m pairs of their N 
measurement results by calculating the QBER, or use 
these m pairs to verify Eq. (16). 

IV. EXPERIMENT 



region with the 0.2 mm detection slits. The pump beam 
is a Gaussian beam with spot size rj 2 mm at the crystal 
face. For measurements in the momentum basis, a 15 cm 
focal length lens is used and the detectors are placed 30 
cm from the crystal face, so that the crystal plane and 
the detection plane coincide with the focal planes of the 
lens. 
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FIG. 2. Experimental arrangements used to test correla- 
tions in position and momentum degrees of freedom. For 
position measurements a lens is used to image the face of 
the non-linear crystal (NLC) onto the detection plane, while 
for momentum measurements both the crystal face and the 
detection plane lie at the focal points of a lens (see text). 

We have performed measurements which demonstrate 
the security of a QKD protocol using position and 
momentum variables by testing the correlations be- 
tween position-position and momentum-momentum co- 
incidence detections, as well the non-correlation between 
position-momentum and momentum-position detections 
in a typical twin photon set-up. The experimental con- 
figuration is shown in Fig. 2. We use a femto-second 
pulsed Ti-Sapphire laser doubled by a 2 mm long BBO 
crystal, obtaining a violet beam with wavelength cen- 
tered around 425 nm. Using the violet beam to pump 
a 1 cm long Lithium Iodate crystal, down-converted sig- 
nal and idler photons were produced and detected in dif- 
ferent wavelengths with interference filters centered in 
890 nm with 10 nm bandwidth and 810 nm with 50 nm 
bandwidth. We use avalanche photodiode single photon 
counting modules equiped with short focal length lenses 
(often called objective lenses, because the focal lengths 
are short, but they play the role of oculars) and a thin slit 
at the entrance. The slits are oriented so that the hor- 
izontal dimension is 3 mm and the vertical dimensions 
are 0.2 mm for position measurements and 0.5 mm for 
momentum measurements. When detection is performed 
in the position basis, the crystal face is imaged by a 15 
cm focal length lens placed 20 cm from the crystal. The 
detectors are placed 60 cm from the lenses, giving a mag- 
nification factor of 3, which allows us to image a narrow 



FIG. 3. Experimental results for xx configurations. 
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FIG. 4. Experimental results for pp configurations. 

Results of the experimental investigations are dis- 
played in Figs. 3-6. All curves are Gaussian fits and er- 
ror bars represent errors due to Poissonian photon count- 
ing statistics. In all measurements detector A was kept 
fixed while B was scanned linearly in the vertical direc- 
tion. Setting detectors A and B for position measure- 
ments, we expect to see a large correlation in coincidence 
measurements. Fig. 3 shows the coincidence count rate 
when detector B is scanned along the vertical axis and 
detector A is fixed at position Axi (triangles) and also 
when A is fixed at Ax2 (circles) . The peaks of the coinci- 
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dence distributions are separated by about 1 mm, which 
is also the separation between Axi and Ax 2 , implying a 
good position correlation. The width of these distribu- 
tions is basically defined by the convolution of the slit 
apertures in both detectors [12]. 

Fig. 4 shows the coincidence count rate when mo- 
mentum measurements are performed at both stations. 
Detector B was scanned while detector A was fixed at 
Ap\ (triangles) and Ap 2 (circles). Api and Ap 2 are sep- 
arated by 1 mm and the separation between the coinci- 
dence peaks is about 1 mm, showing a good momentum 
correlation. The widths of these curves also depend on 
the overlap between the detection apertures, as the mo- 
mentum measurement is actually mapped onto measure- 
ments of the detector positions. 

To show that the two-photon state is indeed EPR cor- 
related, we calculate the variances in inequality (16) us- 
ing data from Figs. 3 and 4, obtaining 



A 2 (A Xl - Bxi) 
A 2 (Ax 2 -Bx 2 ) 
A 2 (A Pl +B Pl ) 
A 2 {A Pl +B Pl ) 



= (0.152 ±0.003)mm 2 , 
= (0.080 ± 0.002)mm 2 , 
(0.912 ±0.017)fr 2 mm" 2 , 
= (0.875 ±0.90)ft 2 mm" 2 . 



(17) 



These values give an average of A 2 A 2 = (0.10 ± 0.02)h 2 , 
which satisfies inequality (16) by about 5 standard devi- 
ations. 

The security of our QKD protocol is based on a 
large correlation when measurements are performed in 
the same basis and low correlations when measurements 
are performed in complementary bases. The measure- 
ments in Figs. 3 and 4 show that the correlation be- 
tween position-position measurements and momentum- 
momentum measurements are very high. Now we are go- 
ing to demonstrate that the correlation between position- 
momentum and momentum-position is negligible. 
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FIG. 5. Experimental results for xp configurations. 



configuration with detector A fixed at Ax± (triangles) 
and Ax 2 (circles) . There is no correlation between Alice 
and Bob's measurements in this case since the coinci- 
dence profile is approximately constant for all positions 
of detector B, as expected from Eq. (7). The slight "en- 
veloping" visible in the coincidence counts is due to a 
small modulation in the single counts as detector B is 
scanned (not shown). Detector A positions Axi and Ax 2 
were chosen so that the coincidence rate is approximately 
the same for both cases. We will show below that this 
is necessary to guarantee the security of the distributed 
key. 
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FIG. 6. Experimental results for px configurations. 

Fig. 6 shows the coincidence profile for the px config- 
uration, where B is scanned in the x basis with detector 
A fixed at Api (triangles) and Ap 2 (circles). As expected 
from Eq. (8), the coincidence count rate reproduces the 
transverse intensity profile of the pump field as a func- 
tion of Bob's detector position only, which shows that in 
this case there is no correlation between Alice and Bob's 
measurements. 

TABLE I. Coincidence counts for Alice and Bob's chosen 
detector positions. 



Bob/Alice 


Axi 


Ax 2 


Api 


Ap 2 


Bxi 


943 ± 31 


72 ±8 


700 ± 26 


655 ± 26 


Bx 2 


67 ±8 


1079 ± 33 


671 ± 26 


765 ± 26 


Bpi 


462 ± 21 


492 ± 22 


956 ± 31 


22 ±5 


B P2 


614 ± 25 


591 ± 24 


29 ±5 


876 ± 30 



The coincidence profile for the xp configuration is 
shown in Fig. 5. Here detector B is scanned in the p 
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Using the results in Figs. 3-6, Bob can choose his 
detector positions so that the security conditions dis- 
cussed in section II are best satisfied. Examining the 
figures, it is most advantageous to define Bxi = 1 mm, 
and Bx2 = 2 mm, Bpi = 1 mm and Bp2 = 2 mm. Table 
I shows the coincidence counts for every possible mea- 
surement at Alice and Bob's stations, from which it can 
be seen that the correlation between measurements in 
the same basis and the non-correlation between measure- 
ments in different bases. There is a slight discrepency 
among the on-diagonal coincidence count rates. A fine- 
tuning of the coincidence levels can always be acheived 
by using neutral filters in front of the detectors so that 
the on-diagonal terms are approximately equal. 

From Table I and Eq. (10), the QBER in the absence of 
an eavesdropper would be QBERq = 0.047 ±0.001. The 
QBER for xx measurements is QBER% X = 0.064 ±0.001 
and QBERfP = 0.027 ±0.001 for pp measurements. The 
security criterion for most QKD protocols is a QBER of 
less than about 0.15 [2]. For a QBER above this limit 
it is impossible to establish a secret key, even with one- 
way error correction and privacy amplication. Since our 
QBER is much lower than this limit, it should be possible 
for Alice and Bob to establish a secure secret key. 

We can use the xp and px measurement results to pre- 
dict the effect of an eavesdropper. Using the results in 
Table I in Eq. (14), the estimated QBER if Eve were 
to measure every one of Bob's photons in a randomly 
chosen basis (x or p) would be QBER = 0.296 ± 0.001 
where we have assumed that Pj(Bj t ;k) — 1/2 for all t 
and j k in Eq. (15). In other words, we have assumed 
that if Eve measures in the wrong basis, she has a 50% 
chance of sending the "correct" replacement photon. We 
see that Eves presence is clearly marked by an increase 
in the QBER. 

V. CONCLUSION 

Recent work [8] has shown that photon pairs created 
by spontaneous parametric down-conversion exhibit en- 
tanglement in position and momentum, of the sort orig- 
inally proposed in the fundamental paper by Einstein- 
Podolsky- Rosen [9]. Here we have extended these ideas 
by experimentally investigating the implementation of a 
quantum key distribution protocol based on the quantum 
correlations between position and momentum of entan- 
gled photon pairs. In addition to interest due to the rela- 
tion with historical debates on Quantum Theory, quan- 
tum key distribution based on position and momentum 
of photon pairs might offer some advantages. First, using 
these degrees of freedom allows for the use of long non- 
linear crystals, therefore opening the possibility of hav- 
ing really high flux entangled-photon sources. Second, 
it might be possible to extend these results to higher di- 
mensional systems, which could be used in quantum com- 
munication protocols such as quantum bit commitment 
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